cloudtravels.co.uk
Open in
urlscan Pro
77.68.30.58
Malicious Activity!
Public Scan
Effective URL: https://cloudtravels.co.uk/arc-cra-online/revenueagency/start.php?program=tax&target=details&lang=en&idp=cms;jsessnid=ysmZz...
Submission Tags: 7118050
Submission: On May 17 via api from GB
Summary
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on November 17th 2020. Valid for: a year.
This is the only time cloudtravels.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.126.10.138 209.126.10.138 | 40021 (CONTABO) (CONTABO) | |
14 | 77.68.30.58 77.68.30.58 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
1 | 2606:4700:20:... 2606:4700:20::681a:507 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST) | |
17 | 5 |
ASN40021 (CONTABO, US)
PTR: server.host504.com
fuentedesalvacionradio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
cloudtravels.co.uk
cloudtravels.co.uk |
669 KB |
1 |
amung.us
whos.amung.us |
144 B |
1 |
waust.at
waust.at |
7 KB |
1 |
fuentedesalvacionradio.com
fuentedesalvacionradio.com |
357 B |
17 | 4 |
Domain | Requested by | |
---|---|---|
14 | cloudtravels.co.uk |
fuentedesalvacionradio.com
cloudtravels.co.uk |
1 | whos.amung.us |
waust.at
|
1 | waust.at |
cloudtravels.co.uk
|
1 | fuentedesalvacionradio.com | |
17 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
whos.amung.us |
Subject Issuer | Validity | Valid | |
---|---|---|---|
fuentedesalvacionradio.com cPanel, Inc. Certification Authority |
2021-04-16 - 2021-07-15 |
3 months | crt.sh |
*.cloudtravels.co.uk Encryption Everywhere DV TLS CA - G1 |
2020-11-17 - 2021-11-16 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-09-04 - 2021-09-04 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://cloudtravels.co.uk/arc-cra-online/revenueagency/start.php?program=tax&target=details&lang=en&idp=cms;jsessnid=ysmZzQipzqPTNSUpbgteTWyvOdKbKNJTrfimOTQVqv
Frame ID: 99B3A1502A9CA84F03271582E47D0D09
Requests: 16 HTTP requests in this frame
Frame:
https://cloudtravels.co.uk/arc-cra-online/revenueagency/door/sig-blk-en.svg
Frame ID: 7DB0B8C4B619CCB98F3713506EFBE267
Requests: 1 HTTP requests in this frame
Frame:
https://cloudtravels.co.uk/arc-cra-online/revenueagency/door/wmms-blk.svg
Frame ID: 7E4BF53F44FE8BEB93492DB20F984C82
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://fuentedesalvacionradio.com/wp-content/uploads/2021/05/cadex.html Page URL
- https://cloudtravels.co.uk/arc-cra-online/revenueagency/ Page URL
- https://cloudtravels.co.uk/arc-cra-online/revenueagency/start.php?program=tax&target=details&lang=en&id... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: 2
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://fuentedesalvacionradio.com/wp-content/uploads/2021/05/cadex.html Page URL
- https://cloudtravels.co.uk/arc-cra-online/revenueagency/ Page URL
- https://cloudtravels.co.uk/arc-cra-online/revenueagency/start.php?program=tax&target=details&lang=en&idp=cms;jsessnid=ysmZzQipzqPTNSUpbgteTWyvOdKbKNJTrfimOTQVqv Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
cadex.html
fuentedesalvacionradio.com/wp-content/uploads/2021/05/ |
115 B 357 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
cloudtravels.co.uk/arc-cra-online/revenueagency/ |
156 B 451 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
start.php
cloudtravels.co.uk/arc-cra-online/revenueagency/ |
28 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
290 KB 290 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme_002.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
28 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
30 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme-jb.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
96 KB 96 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
typeahead.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
project-jb-style.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
118 KB 118 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
project-style.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
42 KB 42 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d.js
waust.at/ |
13 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
glyphicons-halflings-regular.woff
cloudtravels.co.uk/arc-cra-online/revenueagency/door/semi/ |
23 KB 23 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sig-blk-en.svg
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ Frame 7DB0 |
10 KB 11 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmms-blk.svg
cloudtravels.co.uk/arc-cra-online/revenueagency/door/ Frame 7E4B |
5 KB 5 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
28 B 144 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cloudtravels.co.uk
fuentedesalvacionradio.com
waust.at
whos.amung.us
209.126.10.138
2606:4700:20::681a:507
67.202.94.93
77.68.30.58
087280e8c5432abfa73e746559de4572d34263fefac3484f125d09386cb836a7
2cc052d474ce6ee267dd164a839814615a04865b2706d1bc1cb73160c55c549f
409431c6d45382c6f353dc8d2dbeff98b90e88c1c728f263e7299d68a55dda53
41fbb280ed197740a1c526e9619c00510e2b32dcbba016261890c9052d3243de
59cbf75521f37224126ca5245658398f41f4edb1d1c4abdd08274e9acfefd937
624fa78098d4b2b96fcbfcc6833cb8c8cbe52cab61de842200d30dbc99607d39
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d
792c90a99278257ce02b561b401f489f2bd5acf0147ded12115b92cc1fba2154
840787fa147628e52a9ee2f640e98efdf524beb19bdf532f2d9fed83e494a00b
8fb1850e00c24b83e04ea4f41fe5774cff1d476a293fa7b35cba97827eb194cd
a722eca6e27c1fddf818755cedb48151b3d7ba19cabaa7c06542784120677337
b493143147246fc0d7a9f377c2526560329e923b8be0bb4c9ac3e408adcfb06f
b9adc9d233ab5f39618b6fa8ff5b5a99aff51fbbe0cc4558e8f5024b15cc1281
e3f871276a81f087b28dcadca177edf7511d7fdd6c8287c51030c4ac454296ab
ea367de6df1889913977d3895f8144334678dd679f9d641b67fc82585a97336b
fc969dc1c6ff531abcf368089dcbaf5775133b0626ff56b52301a059fc0f9e1e